Analysis
-
max time kernel
141s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
09/01/2024, 19:49
Static task
static1
Behavioral task
behavioral1
Sample
4f0f85897a9b7433c131ff176deb3039.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
4f0f85897a9b7433c131ff176deb3039.exe
Resource
win10v2004-20231222-en
General
-
Target
4f0f85897a9b7433c131ff176deb3039.exe
-
Size
771KB
-
MD5
4f0f85897a9b7433c131ff176deb3039
-
SHA1
1730c95f61f9d31bea72dd4baceb67373d0a7e8b
-
SHA256
01cd7881995f82ddab6a88f787ca40c894b2ae009ab452d092d3c82f0e36840c
-
SHA512
e0ebc1385c9b52e450bc1aa531ad409aeeb47bbacb3f19cd74c88b7986c4e2a1e7deeec00f9fa218568fff4f40d301861944b01a53d1ba42598b78e42f86ca0e
-
SSDEEP
12288:VAWrZ/Fhvj1Z2Qm6u+qvb10VHmDXTuFaa2AtyGTKOF25ZoJJyhRge8BpH9PVB:uuhvjqQm0qvb10hJaothZ2/T6FBBB
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1044 4f0f85897a9b7433c131ff176deb3039.exe -
Executes dropped EXE 1 IoCs
pid Process 1044 4f0f85897a9b7433c131ff176deb3039.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1036 4f0f85897a9b7433c131ff176deb3039.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 1036 4f0f85897a9b7433c131ff176deb3039.exe 1044 4f0f85897a9b7433c131ff176deb3039.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1036 wrote to memory of 1044 1036 4f0f85897a9b7433c131ff176deb3039.exe 88 PID 1036 wrote to memory of 1044 1036 4f0f85897a9b7433c131ff176deb3039.exe 88 PID 1036 wrote to memory of 1044 1036 4f0f85897a9b7433c131ff176deb3039.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\4f0f85897a9b7433c131ff176deb3039.exe"C:\Users\Admin\AppData\Local\Temp\4f0f85897a9b7433c131ff176deb3039.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\4f0f85897a9b7433c131ff176deb3039.exeC:\Users\Admin\AppData\Local\Temp\4f0f85897a9b7433c131ff176deb3039.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:1044
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
771KB
MD5b9efe136bb443c23c0364b520efe1dbf
SHA103f79c50f9853890f4aa145bddbfb5f017178fc2
SHA25605189d5cf2092fd9b0002699e55e78c769558abc8ad6acc60a2ddb9fcd6005a1
SHA512d454302f73191f056e2f9ea3967288388b78912824ca7644e248a54cc8462c53be942474372ffdeecfe8a28ae1102df8acc290f6b5299fb3aad4a7e990dd1196